Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 02:12
Static task
static1
Behavioral task
behavioral1
Sample
77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
-
Target
77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe
-
Size
843KB
-
MD5
9d9d0f509e1b48df31c0df90b821b589
-
SHA1
8a21b32c7f118da063a8ae156e0dd698d9e9a3c2
-
SHA256
77557d3613771f811e8619f8132000f90b750838848012010804128792e39812
-
SHA512
bda0ccd520d4d065346afbd5d968c34a04c8236268ba2ae7a56532bcbc892890a8df1747f80622848a7d11f5dba5d3dfcedbf03e613220f82dbb839c98547346
-
SSDEEP
24576:kKt5WS6+zmfHIF3McXxVSKcbQQQgFAuC+:T5e+vF37XxMKuQhkAr+
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4720 set thread context of 4620 4720 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe 80 -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeSecurityPrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeTakeOwnershipPrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeLoadDriverPrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeSystemProfilePrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeSystemtimePrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeProfSingleProcessPrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeIncBasePriorityPrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeCreatePagefilePrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeBackupPrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeRestorePrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeShutdownPrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeDebugPrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeSystemEnvironmentPrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeChangeNotifyPrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeRemoteShutdownPrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeUndockPrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeManageVolumePrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeImpersonatePrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: SeCreateGlobalPrivilege 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: 33 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: 34 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: 35 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe Token: 36 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4720 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe 4620 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4720 wrote to memory of 4620 4720 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe 80 PID 4720 wrote to memory of 4620 4720 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe 80 PID 4720 wrote to memory of 4620 4720 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe 80 PID 4720 wrote to memory of 4620 4720 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe 80 PID 4720 wrote to memory of 4620 4720 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe 80 PID 4720 wrote to memory of 4620 4720 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe 80 PID 4720 wrote to memory of 4620 4720 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe 80 PID 4720 wrote to memory of 4620 4720 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe 80 PID 4720 wrote to memory of 4620 4720 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe 80 PID 4720 wrote to memory of 4620 4720 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe 80 PID 4720 wrote to memory of 4620 4720 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe 80 PID 4720 wrote to memory of 4620 4720 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe 80 PID 4720 wrote to memory of 4620 4720 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe 80 PID 4720 wrote to memory of 4620 4720 77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe"C:\Users\Admin\AppData\Local\Temp\77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe"C:\Users\Admin\AppData\Local\Temp\77557d3613771f811e8619f8132000f90b750838848012010804128792e39812.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4620
-